Ensure 'Remediation action for Severe threats' is set to 'Quarantine or Remove'

보통레벨 1자동intune-defender

설명

This policy setting configures which automatic remediation action Microsoft Defender Antivirus will take for each threat alert level detection. The recommended state for this setting is: Quarantine. Moves files to quarantine. Configuring this setting to Remove. Removes files from system. also conforms to the benchmark. Audit: value 5 under ...\Windows Defender\Threats\ThreatSeverityDefaultAction must be 2 (Quarantine) or 3 (Remove).

점검 방법

감사 방식: Windows 레지스트리

registry

$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction' -Name '5' -ErrorAction SilentlyContinue).'5'; if (-not ($null -ne $v -and @('2','3') -contains [string]$v)) { $bad += '5=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

1.10 Reporting 1.10.1 Ensure 'Configure Watson events' is set to 'Disabled' (Automated)   1.11 Scan 1.12 Security Intelligence Updates 1.13 Threats CIS Benchmark Recommendation Set Correctly Yes No 1.14 Ensure 'Turn off routine remediation' is set to 'Disabled' (Automated)   2 Defender 2.1 Ensure 'Allow Archive Scanning' is set to 'Allowed' (Automated)   2.2 Ensure 'Allow Behavior Monitoring' is set to 'Allowed' (Automated)   2.3 Ensure 'Allow Cloud Protection' is set to 'Allowed' (Automated)   2.4 Ensure 'Allow Email Scanning' is set to 'Allowed' (Automated)   2.5 Ensure 'Allow Full Scan Removable Drive Scanning' is set to 'Allowed' (Automated)   2.6 Ensure 'Allow On Access Protection' is set to 'Allow' (Automated)   2.7 Ensure 'Allow Realtime Monitoring' is set to ...

속성

운영 체제: 모두
태그: intune-defenderintuneregistry
참고 자료: CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 - 2.50 Ensure 'Remediation action for Severe threats' is set to 'Quarantine or Remove'

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target intune-defender